CVE-2014-1859: Vulnerability in NumPy allows local users to write to arbitrary files
Summary
CVE-2014-1859: (1) core/tests/test_memmap.py, (2) core/tests/test_multiarray.py, (3) f2py/f2py2e.py, and (4) lib/tests/test_io.py in NumPy before 1.8.1 allow local users to write to arbitrary files via a symlink attack on a temporary f... Affects numpy across 2 version ranges.
< 0bb46c1448b0d3f5453d5182a17ea7ac5854ee15
< 1.8.1
Fixed in 0bb46c1448b0d3f5453d5182a17ea7ac5854ee15. How to fix ↓
Also tracked for
- python-numpy · Debian:10
The same CVE-2014-1859 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
NumPy is a popular package in the Python ecosystem that provides support for large, multi-dimensional arrays and matrices, along with a collection of mathematical functions to operate on these arrays. It is widely used in scientific computing and data analysis applications. However, prior to version 1.8.1, NumPy was susceptible to a vulnerability that allowed local users to write to arbitrary files through a symlink attack on a temporary file.
Vulnerability Detail
The vulnerability affected several files in the NumPy package, including core/tests/test_memmap.py, core/tests/test_multiarray.py, f2py/f2py2e.py, and lib/tests/test_io.py. By exploiting a symlink attack on a temporary file, local users could gain unauthorized write access to arbitrary files. This could lead to unauthorized modification or disclosure of sensitive data, as well as potential privilege escalation.
How To Fix
Latest published version: 2.5.4 as of 23 Oct 2026
pip install --upgrade "numpy==2.5.4"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0bb46c1448b0d3f5453d5182a17ea7ac5854ee15
This is the first release that contains the fix.
pip install --upgrade "numpy==0bb46c1448b0d3f5453d5182a17ea7ac5854ee15"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of NumPy is not feasible, a possible workaround is to ensure that the temporary files used by the affected files are created in a secure manner, such as using a dedicated directory with restricted permissions. Additionally, it is important to review and validate the file permissions and ownerships to prevent unauthorized access.
Conclusion
The vulnerability in NumPy prior to version 1.8.1 allowed local users to write to arbitrary files through a symlink attack on a temporary file. To mitigate this vulnerability, it is crucial to update the NumPy package to version 1.8.1 or later. If upgrading is not possible, implementing secure practices for temporary file handling and reviewing file permissions can serve as a workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for numpy →
FAQ
NumPy is a Python package that provides support for large, multi-dimensional arrays and matrices, along with a collection of mathematical functions to operate on these arrays. It is widely used in scientific computing and data analysis applications.
A symlink attack, also known as a symbolic link attack, is a security vulnerability that occurs when a malicious user creates a symbolic link to a sensitive file or directory. By exploiting this vulnerability, the attacker can gain unauthorized access to the target file or directory.
The vulnerability in NumPy could allow local users to write to arbitrary files, potentially leading to unauthorized modification or disclosure of sensitive data. It could also be leveraged for privilege escalation attacks.
To fix this vulnerability, it is recommended to update the NumPy package to version 1.8.1 or later. This can be done by running the command 'pip install --upgrade numpy==1.8.1'.
If upgrading to the latest version of NumPy is not feasible, a possible workaround is to ensure that the temporary files used by the affected files are created in a secure manner, such as using a dedicated directory with restricted permissions. Additionally, it is important to review and validate the file permissions and ownerships to prevent unauthorized access.
References
Related vulnerabilities
Recent vulnerabilities recorded for numpy.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
